Since 1 September 2023, the revised Federal Act on Data Protection (nFADP) has governed how every Swiss company collects and uses personal data. In 2026, the law applies in full and the Federal Data Protection and Information Commissioner (FDPIC) can open investigations. Under the Federal Act on Data Protection (Swiss Confederation, 2023, arts. 60 and 61), certain intentional violations expose the private person responsible to a fine of up to CHF 250,000. Yet many SMEs in French-speaking Switzerland are still flying blind: a cookie banner copied from a French website, newsletters sent to old contacts who never gave consent, forms that hoover up more data than necessary.
The good news: bringing a typical marketing setup into compliance — website, newsletter, online advertising — takes a few days of work, not a few months. Here is what the law actually requires for your newsletters, cookies, forms and tracking, followed by a checklist you can implement without a lawyer.
The nFADP in a Nutshell: What Affects Your Marketing
The nFADP protects the data of natural persons: first name, email address, IP address, browsing behaviour, purchase history. As soon as a marketing tool touches any of this information, the law applies. Three principles underpin everything else:
- Transparency: you must clearly inform people about what you collect, why, and who you share it with — that is the role of your website's privacy statement.
- Proportionality: you only collect the data necessary for the stated purpose. A quote request form does not need a date of birth.
- Security: data must be protected technically and organisationally, and breaches presenting a high risk must be reported to the FDPIC.
Unlike the European GDPR, the nFADP does not provide for fines calculated on turnover and does not require SMEs to appoint a data protection officer. Under the Data Protection Ordinance (Federal Council, 2022, art. 24), the record of processing activities is even optional below 250 employees, except for large-scale sensitive data or high-risk profiling. However, if you actively target customers in the European Union — deliveries to neighbouring France, campaigns in Lyon or Annecy — the GDPR applies on top of Swiss law.
Newsletters: Consent Comes First
Sending commercial newsletters is governed by two pieces of legislation: the nFADP for the data, and the Unfair Competition Act (UCA) for the mass advertising email itself. In practice, three cumulative conditions apply:
- Prior consent (opt-in): the person ticked a box or confirmed a subscription. A pre-ticked box counts for nothing, and neither does a purchased address list.
- An identifiable sender: your company name and a valid contact address in every mailing.
- A working unsubscribe link in every email, effective immediately and free of charge.
There is a valuable exception for SMEs: your existing customers may receive offers for products or services similar to those they have already purchased, without a new opt-in, provided they were able to refuse when their address was collected. A garage in Nyon can write to its customers about tyre changes; it cannot rent its list to an insurer.
A database of "legacy" contacts with no proof of consent is a liability, not an asset. A re-permission campaign — an email asking people to confirm their subscription — often retains only part of the list, but those are genuinely engaged contacts. The others were probably no longer opening your emails anyway.
Cookies and Tracking: What Swiss Law Actually Requires
This is the most misunderstood point. Swiss law does not impose the blocking, European-style consent banner: the Telecommunications Act requires you to inform visitors about the processing — via the privacy statement — and to tell them how to refuse it. An SME that targets only Switzerland can therefore legally operate with an information banner and an opt-out option.
Be careful, however, with three situations that raise the bar:
- A targeted European audience: EU rules (the ePrivacy Directive and the GDPR) then require prior consent before any non-essential cookie — a banner with equivalent "Accept" and "Refuse" buttons becomes necessary.
- Advertising tools: the Meta pixel, Google Ads tag and remarketing lists create profiles. The nFADP strictly regulates high-risk profiling; to be safe, make these tags conditional on consent. That is the setup we recommend for our Google Ads campaigns in Geneva.
- Transfers outside Switzerland: Google Analytics and Meta transfer data to the United States. This is lawful when the provider is certified under the Swiss-U.S. Data Privacy Framework — check the certification and mention the transfer in your privacy statement.
In practice, a consent management platform (CMP) suited to an SME website settles most of the matter: a compliant banner, advertising tags blocked before consent, and a time-stamped proof log. Prices vary with traffic and the number of domains: check the provider's pricing page.
Forms: Minimise, Inform, Secure
Every form on your website is a collection point subject to the nFADP. Three reflexes:
- Minimisation: only ask for what you need in order to respond. Name, email and message are enough for a contact form — every superfluous field also hurts your conversion rate.
- Information at the point of collection: a link to the privacy statement below the submit button. If the form also feeds your newsletter, add a separate checkbox, never pre-ticked.
- Security: HTTPS is mandatory, and data must be sent to a professional mailbox — not to an employee's personal Gmail account.
During a redesign or a website creation project in Geneva, building these requirements in from the start costs nothing extra; retrofitting them onto a poorly built site quickly costs far more.
Discover our services · Chat on WhatsApp
The Compliance Checklist, No Lawyer Required
Here is the full journey, in order. Allow one to two days of work for an SME with a showcase website and a newsletter:
- Map your data (2 hrs): list where customer data lives — CRM, emailing tool, Google Analytics, Excel files, point-of-sale system. For each source: which data, what purpose, which provider, which country.
- Write or update your privacy statement (3 hrs): identity of the controller, data collected, purposes, recipients, transfers abroad, individuals' rights, contact address. Free Swiss generators provide a solid basis to adapt.
- Run a cookie scan (1 hr): a free analysis tool lists the cookies your site actually sets. Remove unused tags — many websites drag several around.
- Install a CMP (2 hrs): a compliant banner, advertising tags blocked before consent, time-stamped proof of choices.
- Clean up your newsletter list (2 hrs): segment the contacts with proof of opt-in, run a re-permission campaign for the others, delete unreachable addresses.
- Check your processors (1 hr): hosting provider, emailing platform, CRM — each must offer a data processing agreement and, for US providers, certification under the Data Privacy Framework.
- Prepare your access request procedure (1 hr): anyone can ask what data you hold about them; under the Data Protection Ordinance (Federal Council, 2022, art. 18), you have 30 days to respond, free of charge. A response template and a designated person are enough.
Bonus point: access requests and data inventories lend themselves very well to AI automation — extracting a contact's data across all your tools then becomes much faster than a manual search.
What Compliance Costs — and What Non-Compliance Costs
The cost depends mainly on how complex your setup is and how much you outsource. For an SME in French-speaking Switzerland with a showcase website, a newsletter and some online advertising, here is what matters:
- A privacy statement adapted to Swiss law: doing it yourself with a generator mainly costs time; if outsourced, the price depends on how many tools and processing activities need describing.
- CMP and tag configuration: the subscription is on the provider's pricing page, and setup depends on how many tags need gating.
- Emailing list clean-up: a few internal hours, generally with no paid tooling.
In-house, compliance costs mainly time. If you outsource it, ask for a firm price for each item. On the other side of the ledger: the fine mentioned in the introduction for intentional violations, the cost of a dispute, and above all the lost trust of customers who pay ever closer attention to how their data is used. To price the website or campaigns that go with it, our published rates and their simulator are a good starting point.
The Three Costly Mistakes
- Copying the privacy policy of a French website: it cites the GDPR and the CNIL, ignores the FDPIC and Swiss law, and commits you to obligations you do not meet. An inaccurate document is worse than an imperfect one.
- Buying address lists: no valid consent covers you, and any spam complaint can cause you trouble.
- Running advertising campaigns without gating your pixels: remarketing without consent exposes you legally and skews your measurement data in the process.
Conclusion: Compliance as a Commercial Advantage
The nFADP is not an obstacle to digital marketing; it is a quality filter. An engaged opt-in list performs better, clean tracking measures better, a transparent website converts better. SMEs that demonstrate serious data governance turn a legal constraint into an argument for trust.
At Digital Swiss Agency, we take these requirements into account from the design stage of the websites, campaigns and newsletters we deliver. Tell us about your current setup in a 15-minute video call: it often helps identify the two or three priority fixes.